CVE-2026-12415: Invoice Generator Privilege Escalation

CVE-2026-12415 Overview

CVE-2026-12415 is a privilege escalation vulnerability in the Invoice Generator plugin for WordPress, affecting versions up to and including 1.0.0. The flaw resides in the pravel_invoice_edit_account() AJAX handler, which is exposed through wp_ajax_nopriv_pravel_invoice_edit_account. The handler accepts attacker-controlled user_id and user_email values from POST data and calls wp_update_user() without authentication, ownership, or nonce checks. Unauthenticated attackers can change any user's email address, including administrators, then trigger WordPress's password reset flow to seize the account. The issue is tracked under [CWE-269: Improper Privilege Management].

Critical Impact
Unauthenticated remote attackers can hijack administrator accounts on any WordPress site running the affected plugin, resulting in full site compromise.

Affected Products

Invoice Generator plugin for WordPress (slug: invoice-creator)
All versions up to and including 1.0.0
WordPress sites with the plugin active and network-accessible

Discovery Timeline

2026-06-27 - CVE-2026-12415 published to NVD
2026-06-29 - Last updated in NVD database

Technical Details for CVE-2026-12415

Vulnerability Analysis

The vulnerability originates in the pravel_invoice_edit_account() function located in lib/user-manage-function.php of the Invoice Generator plugin. WordPress plugins register AJAX handlers using two hooks: wp_ajax_{action} for authenticated users and wp_ajax_nopriv_{action} for unauthenticated users. Registering the account-edit handler under the nopriv hook exposes it to any anonymous visitor.

Inside the handler, the plugin reads user_id and user_email directly from the POST body and passes them to WordPress's wp_update_user() API. The function performs no capability check, no nonce validation, and no verification that the calling session owns the target account. As a result, any attacker can rewrite the email address of an arbitrary user identifier, including the site's administrator (user_id=1 on most installs).

Once the administrator's email is set to an attacker-controlled address, the attacker uses WordPress's built-in wp-login.php?action=lostpassword flow to request a reset link, receives it at the substituted email, and takes full control of the site.

Root Cause

The root cause is a missing capability check combined with the use of wp_ajax_nopriv_* registration for a privileged operation. wp_update_user() is a trusted API intended for use only after verifying current_user_can('edit_user', $user_id) and a valid nonce via check_ajax_referer(). Neither guard is present, mapping directly to [CWE-269: Improper Privilege Management].

Attack Vector

Exploitation requires only network access to the target site's admin-ajax.php endpoint. An attacker sends a single unauthenticated POST request specifying action=pravel_invoice_edit_account, a target user_id, and an attacker-controlled user_email. After the plugin overwrites the victim's email, the attacker triggers the standard WordPress password reset flow and completes account takeover. No user interaction, credentials, or prior foothold are needed. See the Wordfence Vulnerability Analysis and the vulnerable source at WordPress Invoice Creator Code for full technical detail.

Detection Methods for CVE-2026-12415

Indicators of Compromise

POST requests to /wp-admin/admin-ajax.php containing action=pravel_invoice_edit_account from unauthenticated sources.
Unexpected changes to the user_email column in the wp_users table, especially for administrator accounts.
Password reset emails delivered to unknown domains shortly after AJAX activity targeting the plugin.
New administrator logins from unfamiliar IP addresses or geographic regions immediately following an email change.

Detection Strategies

Inspect webserver access logs for POST requests to admin-ajax.php with the pravel_invoice_edit_account action and no authentication cookie.
Query the WordPress database for recent user_email modifications and correlate with wp_usermeta timestamps.
Deploy a WordPress audit-logging plugin to track profile field changes and administrator role assignments.
Alert on password reset events for privileged accounts that were not initiated from a known workstation.

Monitoring Recommendations

Forward WordPress and webserver logs into a centralized analytics platform and alert on the pravel_invoice_edit_account action string.
Baseline administrator email addresses and generate alerts whenever the value changes.
Monitor outbound mail queues for password reset messages sent to newly introduced recipient domains.

How to Mitigate CVE-2026-12415

Immediate Actions Required

Deactivate and remove the Invoice Generator plugin (invoice-creator) on any site running version 1.0.0 or earlier until a patched release is verified.
Audit all WordPress user accounts and reset the email address and password for any administrator whose profile changed unexpectedly.
Invalidate active sessions site-wide by rotating the WordPress salts in wp-config.php.
Restrict access to admin-ajax.php from unauthenticated sources at the web application firewall where feasible.

Patch Information

At the time of publication, no vendor-supplied patched version has been referenced in the NVD entry. Refer to the Wordfence Vulnerability Analysis and the plugin repository for updates. Any fix must replace wp_ajax_nopriv_pravel_invoice_edit_account with the authenticated wp_ajax_pravel_invoice_edit_account hook and add both current_user_can() and check_ajax_referer() checks before invoking wp_update_user().

Workarounds

Block requests to admin-ajax.php where the action parameter equals pravel_invoice_edit_account using a WAF rule.
Restrict /wp-admin/ access to trusted IP ranges via webserver ACLs.
Enforce two-factor authentication on all administrator accounts so that a password reset alone does not grant access.
Temporarily disable the plugin via WP-CLI: wp plugin deactivate invoice-creator.

bash

# Configuration example: NGINX rule to block the vulnerable AJAX action
location = /wp-admin/admin-ajax.php {
    if ($request_method = POST) {
        if ($args ~* "action=pravel_invoice_edit_account") { return 403; }
    }
    if ($request_body ~* "action=pravel_invoice_edit_account") { return 403; }
    include fastcgi_params;
    fastcgi_pass php-fpm;
}